ci: complete pre-visibility validation

Author: CometAPI

.github/workflows/ci.yml

@@ -25,9 +25,9 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
@@ -65,9 +65,9 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install the pinned uv frontend
@@ -83,9 +83,9 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.10"
       - name: Install the pinned uv frontend
@@ -104,9 +104,9 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
@@ -125,9 +125,9 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
@@ -145,7 +145,7 @@ jobs:
       - name: Record immutable artifact digests
         run: sha256sum dist/* > artifact-sha256.txt
       - name: Retain verified artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-distributions
           path: |
@@ -161,12 +161,20 @@ jobs:
     timeout-minutes: 35
     steps:
       - name: Check out the candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
         run: python -m pip install --disable-pip-version-check "uv==$UV_VERSION"
       - name: Verify from a copied standalone repository
         run: python scripts/check_repository_independence.py
+      - name: Download the verified package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: verified-artifacts
+      - name: Recheck retained artifact digests
+        working-directory: verified-artifacts
+        run: sha256sum --check artifact-sha256.txt

.github/workflows/live-smoke.yml

@@ -33,12 +33,12 @@ jobs:
     environment: live-smoke
     steps:
       - name: Check out the trusted default branch
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend

.github/workflows/publish.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the published release tag
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: refs/tags/${{ github.event.release.tag_name }}
           fetch-depth: 0
@@ -40,7 +40,7 @@ jobs:
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: bash scripts/verify_release_trust.sh
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
@@ -73,7 +73,7 @@ jobs:
       - name: Record immutable artifact digests
         run: sha256sum dist/* > artifact-sha256.txt
       - name: Retain only the verified release bundle
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-${{ steps.version.outputs.version }}
           path: |
@@ -106,7 +106,7 @@ jobs:
       COMETAPI_LIVE_STOP_ON_FAILURE: "1"
     steps:
       - name: Check out the verified release commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.build.outputs.release-commit }}
           persist-credentials: false
@@ -115,7 +115,7 @@ jobs:
           RELEASE_COMMIT: ${{ needs.build.outputs.release-commit }}
         run: test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned uv frontend
@@ -142,7 +142,7 @@ jobs:
       id-token: write
     steps:
       - name: Download the verified release bundle
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-${{ needs.build.outputs.version }}
           path: release-bundle
@@ -167,19 +167,19 @@ jobs:
       contents: read
     steps:
       - name: Check out the registry verification source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.build.outputs.release-commit }}
           persist-credentials: false
       - name: Download the verified release bundle after checkout
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-${{ needs.build.outputs.version }}
           path: release-bundle
       - name: Require retained pre-publication digest evidence
         run: test -f release-bundle/artifact-sha256.txt
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
       - name: Install the pinned provenance verifier

pyproject.toml

@@ -38,9 +38,11 @@ dev = [
     "pyright>=1.1.408,<2.0.0",
     "pytest>=8.3.5,<10.0.0",
     "pytest-asyncio>=0.24.0,<2.0.0",
+    "pyyaml>=6.0.2,<7.0.0",
     "ruff>=0.12.0,<1.0.0",
     "tomli>=2.2.1,<3.0.0",
     "twine>=6.1.0,<7.0.0",
+    "types-pyyaml>=6.0.12,<7.0.0",
 ]
 
 [build-system]

scripts/check_version.py

@@ -160,6 +160,11 @@ def require_public_preview_docs() -> None:
     documents = _read_public_documents(violations)
     _check_project_identity(violations)
 
+    if Path(".github/CODEOWNERS").exists():
+        violations.append(
+            ".github/CODEOWNERS: must remain absent until a real multi-maintainer model exists"
+        )
+
     try:
         license_text = Path("LICENSE").read_text(encoding="utf-8")
     except (OSError, UnicodeError) as exc: